{"id":"CLSA-2026-1789580964","summary":"389-ds-base: Fix of 4 CVEs","details":"- CVE-2026-18922: reset the SASL auxprop context after a failed one-shot bind so a\n  stale canon_user identity cannot be inherited by a later successful bind\n- CVE-2026-18355: validate the minimum SASL packet length in sasl_io_start_packet to\n  prevent an unsigned underflow in sasl_io_read_packet\n- CVE-2026-76560: reject anonymous clients before evaluating the SELFDN, USERDNATTR\n  and LDAPURL ACI bind rules\n- CVE-2026-18453: check the paged-results backend pointer for NULL before reusing a\n  slot in op_shared_search","modified":"2026-10-26T09:43:21.667248293Z","published":"2026-09-16T17:49:37Z","upstream":["CVE-2026-18355","CVE-2026-18453","CVE-2026-18922","CVE-2026-76560"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1789580964.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18355"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18453"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18922"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76560"}],"affected":[{"package":{"name":"389-ds-base","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/389-ds-base?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1-12.el9_6.tuxcare.els5"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1789580964.json"}},{"package":{"name":"389-ds-base-devel","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/389-ds-base-devel?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1-12.el9_6.tuxcare.els5"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1789580964.json"}},{"package":{"name":"389-ds-base-libs","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/389-ds-base-libs?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1-12.el9_6.tuxcare.els5"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1789580964.json"}},{"package":{"name":"389-ds-base-snmp","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/389-ds-base-snmp?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1-12.el9_6.tuxcare.els5"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1789580964.json"}},{"package":{"name":"python3-lib389","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/python3-lib389?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1-12.el9_6.tuxcare.els5"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1789580964.json"}}],"schema_version":"1.9.0"}